Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

How would you go about reverse engineering malware w32/malware!gemini. Recently I found it installed on my computer and would like to trace where the data is being sent. Thank you.

share|improve this question

1 Answer

up vote 3 down vote accepted

Well there's a slight difference between the two.

The best way to try and determine where the data is being sent is to monitor and trace all of your outbound traffic.

If you'd like to reverse engineer it to possibly learn more about it and if you are missing anything as far as what it is doing or what it is sending there'd be a slightly different path.

Monitoring a clean and controlled system, using packet sniffers in conjunction with IDS(s), trying to disassemble any binaries you find that it adds, debugging/looking at the strings/hexediting as best you can should garner you plenty more information about it than you currently know.

share|improve this answer
So wireshark to sniff. Where would I start? Any specific filters that would be more likely to sniff this exact traffic? Do you have a IDS that you recommend? Thank you for the reply. – m4ck Jan 29 '12 at 6:12
@m4ck - You want an honest answer? If you do not already know where to start, then you do not have the tools nor the ability to track where the data is being sent to, besides what are you going to do if you do find the desination of the data? I guarantee you its in a country that could careless about your rights. – Ramhound Jan 30 '12 at 15:11
1  
Everyone has to start somewhere. I would forward the information I found to proper authorities or someone that might possible care or take proper action. Or use the information for record keeping purposes. – m4ck Jan 30 '12 at 16:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.